Last updated: 2026-08-31 Mon
 |
| [image source: Amazon.com] |
Build an AI Agent (From Scratch)
- https://www.manning.com/books/build-an-ai-agent-from-scratch
- https://livebook.manning.com/book/build-an-ai-agent-from-scratch
- https://www.amazon.com/Build-Agent-Scratch-Jungjun-Hur/dp/1633434613/
Publication Date: August 18, 2026 (paperback)
https://github.com/shangrilar/ai-agent-from-scratch
- "Code repository for Manning's Build an AI Agent From Scratch"
- License: MIT
- 57.6% Jupyter Notebook
- 42.4% Python
My LinkedIn post: link
My Amazon Review: link
***********************************************************************************
3 stars
A Good Introduction to Building AI Agents - but security-lite
This book is well written (given its length, and breadth of topics covered), and I like the pacing as well as the quality of the diagrams and illustrations.
A key missing aspect – which I consider to be essential for a 5-star rating: Additional Suggested Reading citations at the end of chapters.
I would like to give this book 4 Stars – but Security is not adequately covered.
There is only one arxiv paper cited in the entire book. Citations of such papers, with information on Agent Security and MCP Security could have easily (and dramatically) improved the coverage of security considerations.
Also, the OWASP MCP Top 10 should have been cited for additional reading.
I think this book should have had a Part 3, Agent Security (with minimally, 2-3 chapters)
This book would be MUCH BETTER if there were some real world examples cited & discussed regarding cybersecurity events that have occurred due to agent misbehavior, and examples of compromised agents.
Prompt Injection, as a security risk, is only mentioned once – with no practical examples.
Chapter 8, page-224, Section 8.2.1 Why sandboxes are necessary
"We also can’t rule out the possibility that malicious users will deliberately try to execute harmful code through prompt injection."
A suggestion for a 2nd edition of this book:
Consider inclusion of this arxiv paper (2602.11964) "Gaia2: Benchmarking LLM Agents on Dynamic and Asynchronous Environments" (2026-02-12)
Some additional observations:
Page-25: Listing 2.2
Still specifies the "system" role
Page-26:
explicitly states that "system" is the previous role name, but that it is now "developer"
Page-26: Listing 2.3
- temperature is discussed, but not shown in the example.
- max_tokens is shown, but not discussed in the example
- this is the only page that mentions max_tokens.
page-58: Limiting the Number of Functions
"As a general guideline keep the number of tools under 20. Using too many tools can lead to selection errors."
This begs the following questions:
- If an agent/LLM can reason, what is magical about 20?
- How do you know when that upper limit changes (increases? decreases?)
- How do you determine the magic number, for future/other models?
- How can you test/detect this aberrant error?
page-67:
"Security vulnerabilities in dependencies require updates."
(see my "Readers should also note:", below)
page-67: Section 3.4 MCP: Standardizing tools
- should provide a link to the MCP specification web site
page-91: Section 4.4.4 Integration MCP tools
This section *really* should include a discussion of the security risks of MCP tools, and real examples of vulnerabilities that have exposed companies to being attacked.
*** Good reminder
page-144: Section 5.5.3 Human-in-the-loop tool-execution approval
"Sensitive operations such as file deletion, email sending, and database modifications should require user confirmation before execution."
*** Good discussion/example
page-159: Section 6.2.4 Compaction strategy
For example, see Page-161: "This code turns 100,000 tokens of noise in every prompt into a precise, on-demand resource. The data can be huge, but the context window remains lean."
*** Good discussion
Chapter 7: Planning and reflection for complex task
*** A good example of the type of additional suggested reading I referenced at the beginning of my review
page-222: Section 8.1.3 The effectiveness of code-based actions
(see the paper citation link, and the discussion in that section – in particular, note Figure 8.3)
*** Good to see this discussed
page-281: Section 9.6 A2A: Collaborating across networks
*** This needs more elaboration, re: my suggestion for a Part 3 Agent Security.
page-286: see discussion "[...] security is a critical concern. [...]"
Readers should also note:
The LiteLLM, that is used throughout the book, suffered a major supply chain attack in March 2026 when malicious versions (1.82.7 and 1.82.8) were published to PyPI, followed by the August 2026 release of a massive 153 GB dataset exposing credentials from over 2,000 affected organizations. (Google "The LiteLLM Supply Chain Attack: How a Poisoned Scanner Exposed 2,000+ Organizations’ AI and Cloud Credentials", by Leah Koonthamattam)
A March 2026 blog post by litellm included the following update:
"Updated: We have now released a new safe version of LiteLLM (v1.83.0) by our new CI/CD v2 pipeline which added isolated environments, stronger security gates, and safer release separation for LiteLLM. We have also verified the codebase is safe and no malicious code was pushed to main."
While the companion GitHub repository for the book stipulates litellm version 1.83.7 (see pyproject.toml, and uv.lock) - on June 1, 2026 – litellm published a blog post:
"Fixed in 1.84.0+ - Version Update: Authentication Bypass via Host Header Injection (GHSA-4xpc-pv4p-pm3w)"
- "The update shipped in v1.84.0. Follow-up path-handling hardening was backported in v1.84.3, v1.85.2, and v1.86.2; upgrading to the latest release is recommended."
***********************************************************************************
Additional Suggested Background Reading:
(illustrative, not exhaustive)
LiteLLM
See:
pyproject.toml: Line #10, "litellm>=1.83.7",
https://github.com/shangrilar/ai-agent-from-scratch/blob/main/pyproject.toml
See:
uv.lock: Line #449, "{ name = "litellm", specifier = ">=1.83.7" },"
https://github.com/shangrilar/ai-agent-from-scratch/blob/main/uv.lock
{ name = "litellm", specifier = ">=1.83.7" },
Security Update: Suspected Supply Chain Incident
https://docs.litellm.ai/blog/security-update-march-2026
"Updated: We have now released a new safe version of LiteLLM (v1.83.0) by our new CI/CD v2 pipeline which added isolated environments, stronger security gates, and safer release separation for LiteLLM. We have also verified the codebase is safe and no malicious code was pushed to main."
2026-06-01: Fixed in 1.84.0+ - Version Update: Authentication Bypass via Host Header Injection (GHSA-4xpc-pv4p-pm3w)
https://docs.litellm.ai/blog/host-header-auth-bypass
"The update shipped in v1.84.0. Follow-up path-handling hardening was backported in v1.84.3, v1.85.2, and v1.86.2; upgrading to the latest release is recommended."
The LiteLLM Supply Chain Attack: How a Poisoned Scanner Exposed 2,000+ Organizations’ AI and Cloud Credentials
by Leah Koonthamattam
https://cybelangel.com/blog/the-litellm-supply-chain-attack/
"In August 2026, a 153 GB dataset of exfiltrated credentials tied to this leak appeared, mapped to more than 2,000 organisations around the world, resulting in one of the largest AI related supply chain incidents of the year."
Supply Chain Attack Exposes 2,500+ Companies in Largest AI Infrastructure Breach of 2026 So Far
https://www.cxtoday.com/security-privacy-compliance/supply-chain-attack-exposes-2500-companies-in-largest-ai-infrastructure-breach-of-2026-so-far/
"[ cybersecurity firm CloudSEK] described the incident as the largest supply-chain attack targeting AI infrastructure identified so far in 2026. Orchestrated by the Team PCP threat actor group in March 2026, the attack affected approximately 434,000 CI/CD pipelines, which are automated workflows that build, test and deploy software code."
How a Poisoned Security Scanner Became the Key to Backdooring LiteLLM
https://snyk.io/blog/poisoned-security-scanner-backdooring-litellm/
GAIA
Benchmarking General AI Agents
https://huggingface.co/gaia-benchmark
https://huggingface.co/spaces/gaia-benchmark/leaderboard
GAIA - A Benchmark for General AI Assistants
https://www.youtube.com/watch?v=tG9CnyhwU8E
GAIA Paper:
GAIA: a benchmark for General AI Assistants (Nov 23, 2023)
https://huggingface.co/papers/2311.12983
https://arxiv.org/abs/2311.12983 (Nov 21, 2023)
https://huggingface.co/collections/gaia-benchmark/gaia-release
https://huggingface.co/datasets/gaia-benchmark/GAIA
JoyAgent-JDGenie: Technical Report on the GAIA (2025-10-01)
https://arxiv.org/abs/2510.00510
Welcome to Meta Agents Research Environments (ARE)
https://facebookresearch.github.io/meta-agents-research-environments/
Meta ARE: Scaling Up Agent Environments and Evaluations
https://ai.meta.com/research/publications/are-scaling-up-agent-environments-and-evaluations/
GAIA2
Gaia2 and ARE: Empowering the Community to Evaluate Agents
https://huggingface.co/blog/gaia2
Gaia2: Benchmarking LLM Agents on Dynamic and Asynchronous Environments (2026-02-12)
https://arxiv.org/abs/2602.11964
Gaia2: Benchmarking LLM Agents on Dynamic and Asynchronous Environments
https://openreview.net/forum?id=9gw03JpKK4
Meta AI Researcher Explains ARE and Gaia2: Scaling Up Agent Environments and Evaluations
https://arize.com/blog/meta-ai-researcher-explains-are-and-gaia2/
https://www.youtube.com/watch?v=lT4qtOlvhak
MCP Security
OWASP MCP Top 10
https://owasp.org/www-project-mcp-top-10/
The State of MCP Security, Pynt's 2025 Report
https://www.pynt.io/blog/llm-security-blogs/state-of-mcp-security
"Pynt’s latest research analyzes 281 MCP configurations collected from open agent frameworks and plugin stacks."
MCP Horror Stories: The Security Issues Threatening AI Infrastructure
https://www.docker.com/blog/mcp-security-issues-threatening-ai-infrastructure/
GitHub MCP Exploited: Accessing private repositories via MCP
https://invariantlabs.ai/blog/mcp-github-vulnerability
Securing the Model Context Protocol (MCP) Server
https://kenhuangus.substack.com/p/securing-the-model-context-protocol
A Security Engineer's Guide to MCP
https://semgrep.dev/blog/2025/a-security-engineers-guide-to-mcp/
Anthropic won't own MCP 'design flaw' putting 200K servers at risk, researchers say
https://www.theregister.com/2026/04/16/anthropic_mcp_design_flaw/
The Mother of All AI Supply Chains: Critical, Systemic Vulnerability at the Core of Anthropic’s MCP
https://www.ox.security/blog/the-mother-of-all-ai-supply-chains-critical-systemic-vulnerability-at-the-core-of-the-mcp/
"Anthropic design choice Exposes 150M+ Downloads and up to 200K Servers to complete takeover"
The Mother of All AI Supply Chains: Technical Deep Dive
https://www.ox.security/blog/the-mother-of-all-ai-supply-chains-technical-deep-dive/
